Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 24 Sep 2002 18:04:12 +0200

> Suppose, again, that the new access router was routing 
  > address K received via
  > HI/HaCK from the old router, which consisted of a prefix H 
  > and a host identifier
  > J, H:J. That is to say, the old access router supports 
  > prefix H. Suppose the new
  > access router supports prefix X.
  > 
  > The new access router does ingress filtering on X. The new 
  > access router doesn't
  > have to accept any address with prefix H just because it 
  > accepts K. It only
  > accepts K.

=> We're revisting this I think, how does it 
know that K is who it claims to be? HI/HACK
are irrelevant. We all know that there is a 
_real_ K on the link, but there is no proof that
the packet arriving at the AR's interface is coming
from K. We already agreed that addresses and MAC
addresses can be spoofed. So how can you know that
the packet came from K and not from some other
node pretending to be K?
This is how /64 spoofing is opened up. 

  > If an attacker tries to use an address H:Q, where Q != J, 
  > the ingress filter
  > rejects it because H != X. However, the address H:J is sent 
  > properly because the
  > source route has been inserted.

=> It doesn't matter, the attacker can still use
H:J, that's still spoofing a prefix because
H is not meant to be used on this link. 

  > Therefore, ingress filtering is irrelevent. It will work 
  > just fine on the new
  > access router, but is subject to the same constraints as 
  > ingress filtering in
  > general.

=> I don't understand how this conclusion can be 
drawn. In normal operation scenarios no one can
send packets with prefix H, regardless of the iid.

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Tue, 24 Sep 2002 09:14:26 -0700

> This is how /64 spoofing is opened up.

Right, that's what I said. Ingress filtering does not stop someone spoofing a
legitimate address, nor spoofing an
address with a legitmate prefix. So, in that sense, it won't stop an attacker
from using an address X:Y, where Y is the host identifier for a legitimate node
on the link using the prefix _for which the router is performing ingress
filtering_.

It's the same way with K. Anybody can spoof K's address, but they can't spoof
another address with H as a prefix.

Solving this problem is what SEND is about.

            jak